IN THE CLAIMS : 

Please substitute the following claims for the pending 
claims with the same number: 

1. - 37. (Canceled) 

38. (Previously Presented) A method for tracking the routing of an 
electronic document, comprising: 

embedding a control mark, including a unique identifier 
and a check sum for authenticating the unique identifier, within a static 
section of an electronic document, wherein the static section and the 
control mark remain unchanged when the electronic document is edited 
by a document editor; and 

monitoring transmitted network packets, for detection of 
network packets containing the electronic document, based on the unique 
identifier, in order to limit access of the electronic document to authorized 
recipients. 

39. (Previously Presented) The method of claim 38 further comprising 
logging an audit record of the transmission, when a network packet 
containing the electronic document is detected by said monitoring, 
wherein the audit record stores information identifying a distribution route 
of the electronic document. 

40. (Original) The method of claim 39 wherein said logging includes 
logging a date and time of the transmission in the audit record. 
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41. (Original) The method of claim 39 wherein said logging includes 
logging a destination of the transmission in the audit record. 

42. (Previously Presented) The method of claim 38 wherein said 
monitoring monitors network packets transmitted internally within an 
organization network. 

43. (Previously Presented) The method of claim 38 wherein said 
monitoring monitors network packets transmitted from within an 
organization network to outside of the organization network. 

44. (Previously Presented) The method of claim 38 wherein said 
monitoring monitors network packets transmitted to an organization 
network from outside of the organization network. 

45. (Original) The method of claim 38 wherein the network packets 
are transmitted in response to an FTP download. 

46. (Original) The method of claim 38 wherein the network packets 
are transmitted in response to an HTTP download. 

47. (Original) The method of claim 38 wherein the network packets 
are transmitted in response to an Instant Messenger download. 

48. (Previously Presented) A system for tracking the routing of an 
electronic document, the system comprising one or more tangible 
computer readable media collectively storing instructions encoding: 

an auto-marking module for embedding a control mark, 
including a unique identifier and a check sum for authenticating the 
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unique identifier, within a static section of an electronic document, 
wherein the static section and the control mark remain unchanged when 
the electronic document is edited by a document editor; and 

a traffic monitor for monitoring transmitted network 
packets, and for detection of network packets containing the electronic 
document, based on the unique identifier, in order to limit access of the 
electronic document to authorized recipients. 

49. (Previously Presented) The system of claim 48 wherein the one or 
more media further store instructions encoding an auditor for logging 
transmission information in an audit record when a network packet 
containing the electronic document is detected by said traffic monitor, 
wherein the audit record stores information identifying a distribution route 
of the electronic document. 

50. (Previously Presented) The system of claim 49 wherein said auditor 
logs a date and time of the network packet's transmission in the audit 
record. 

51. (Previously Presented) The system of claim 49 wherein said auditor 
logs a destination for the network packet in the audit record. 

52. (Previously Presented) The system of claim 48 wherein said traffic 
monitor monitors network packets transmitted internally within an 
organization network. 

53. (Previously Presented) The system of claim 48 wherein said traffic 
monitor monitors network packets transmitted from within an organization 
network to outside of the organization network. 
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54. (Previously Presented) The system of claim 48 wherein said traffic 
monitor monitors network packets transmitted to an organization network 
from outside of the organization network. 

55. (Original) The system of claim 48 wherein the network packets are 
transmitted in response to an FTP download. 

56. (Original) The system of claim 48 wherein the network packets are 
transmitted in response to an HTTP download. 

57. (Original) The system of claim 48 wherein the network packets are 
transmitted in response to an Instant Messenger download. 

58. - 90. (Canceled) 
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